Security audit
Security checks for vulnerabilities and agentic risk
The skill is a Python helper, but it can run arbitrary Python and rewrite files without clear safety controls, so users should review it before installing.
Install only if you want a Python helper that can execute local Python code and modify Python files. Use the run command only on code you trust and preferably in an isolated workspace; use version control or backups before using format.
The metadata presents the skill as a cookbook of Python recipes, but the documented behavior includes executing arbitrary Python code and local files, plus acting as a shell-style utility. This mismatch increases the chance that users or orchestration systems invoke a much more powerful skill than intended, creating a path to unintended code execution and file/system effects.
The run command executes arbitrary Python code provided inline or from a local file, yet the skill text does not present this as a high-risk action or warn about execution consequences. In this skill's context, that is especially dangerous because the skill appears cookbook-like and helpful, which can lower user caution around a command that can run arbitrary local code.
The skill presents itself as a Python cookbook/snippet helper, but it also includes a run command that executes arbitrary inline Python or any referenced Python file. In an agent setting, this creates a hidden code-execution surface that can be invoked with untrusted input, enabling arbitrary command execution via Python and violating least-privilege expectations.
The cmd_run implementation allows callers to pipe arbitrary Python source to python3 or execute any specified .py file, which is a direct arbitrary code execution primitive. Because the skill's stated role is cookbook/snippet assistance rather than code execution, this capability is unjustified and increases the chance that an orchestrating agent or user will invoke dangerous behavior without realizing it.
The skill advertises commands that read files, modify files, and execute shell/Python actions, but it declares no explicit tool scope such as allowed-tools or permissions. That makes the operational boundary unclear and can enable broader-than-expected access when invoked, especially because the same skill includes code execution and formatting behavior.
The trigger phrases are broad, common, and likely to match ordinary Python-related requests, which can cause unintended invocation of a skill that includes execution and file-modifying commands. In context, this is more dangerous than a harmless lookup skill because accidental activation could expose users to code-running or file-changing workflows they did not intend to authorize.
The format command is described as auto-formatting a Python file but does not clearly warn that it modifies the target file in place. Users may treat it as a diagnostic or preview operation and unintentionally alter source files, which can disrupt workflows or overwrite manual formatting/content.
The script executes code without any explicit safety warning, trust boundary guidance, or confirmation step, which makes accidental execution of untrusted code more likely. In a skill ecosystem, silent execution features are especially risky because users may assume the tool only displays snippets or performs static checks.
cmd_format invokes black or autopep8 --in-place, which rewrites the provided files. The script logs formatter usage and success, but it does not clearly disclose beforehand in the command help or function messaging that formatting will overwrite file contents.
No suspicious patterns detected.
